/* DO NOT EDIT

  This file was automatically generated by Pidl

  from eventlog.idl and eventlog.cnf.

  Pidl is a perl based IDL compiler for DCE/RPC idl files.

  It is maintained by the Samba team, not the Wireshark team.

  Instructions on how to download and install Pidl can be

  found at https://wiki.wireshark.org/Pidl

*/

#include "config.h"

#include <string.h>

#include <wsutil/array.h>

#include <epan/packet.h>

#include <epan/tfs.h>

#include "packet-dcerpc.h"

#include "packet-dcerpc-nt.h"

#include "packet-windows-common.h"

#include "packet-dcerpc-eventlog.h"

void proto_register_dcerpc_eventlog(void);

void proto_reg_handoff_dcerpc_eventlog(void);

/* Ett declarations */

static int ett_dcerpc_eventlog;

static int ett_eventlog_eventlogReadFlags;

static int ett_eventlog_eventlogEventTypes;

static int ett_eventlog_eventlog_OpenUnknown0;

static int ett_eventlog_eventlog_Record;

static int ett_eventlog_eventlog_ChangeUnknown0;

/* Header field declarations */

static int hf_eventlog_Record;

static int hf_eventlog_Record_computer_name;

static int hf_eventlog_Record_length;

static int hf_eventlog_Record_source_name;

static int hf_eventlog_Record_string;

static int hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE;

static int hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS;

static int hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE;

static int hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE;

static int hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE;

static int hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ;

static int hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ;

static int hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ;

static int hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ;

static int hf_eventlog_eventlog_BackupEventLogW_backupfilename;

static int hf_eventlog_eventlog_BackupEventLogW_handle;

static int hf_eventlog_eventlog_ChangeNotify_handle;

static int hf_eventlog_eventlog_ChangeNotify_unknown2;

static int hf_eventlog_eventlog_ChangeNotify_unknown3;

static int hf_eventlog_eventlog_ChangeUnknown0_unknown0;

static int hf_eventlog_eventlog_ChangeUnknown0_unknown1;

static int hf_eventlog_eventlog_ClearEventLogW_backupfilename;

static int hf_eventlog_eventlog_ClearEventLogW_handle;

static int hf_eventlog_eventlog_CloseEventLog_handle;

static int hf_eventlog_eventlog_DeregisterEventSource_handle;

static int hf_eventlog_eventlog_FlushEventLog_handle;

static int hf_eventlog_eventlog_GetLogInformation_cbBufSize;

static int hf_eventlog_eventlog_GetLogInformation_cbBytesNeeded;

static int hf_eventlog_eventlog_GetLogInformation_dwInfoLevel;

static int hf_eventlog_eventlog_GetLogInformation_handle;

static int hf_eventlog_eventlog_GetLogInformation_lpBuffer;

static int hf_eventlog_eventlog_GetNumRecords_handle;

static int hf_eventlog_eventlog_GetNumRecords_number;

static int hf_eventlog_eventlog_GetOldestRecord_handle;

static int hf_eventlog_eventlog_GetOldestRecord_oldest;

static int hf_eventlog_eventlog_OpenBackupEventLogW_handle;

static int hf_eventlog_eventlog_OpenBackupEventLogW_logname;

static int hf_eventlog_eventlog_OpenBackupEventLogW_unknown0;

static int hf_eventlog_eventlog_OpenBackupEventLogW_unknown2;

static int hf_eventlog_eventlog_OpenBackupEventLogW_unknown3;

static int hf_eventlog_eventlog_OpenEventLogW_MajorVersion;

static int hf_eventlog_eventlog_OpenEventLogW_MinorVersion;

static int hf_eventlog_eventlog_OpenEventLogW_Module;

static int hf_eventlog_eventlog_OpenEventLogW_RegModuleName;

static int hf_eventlog_eventlog_OpenEventLogW_handle;

static int hf_eventlog_eventlog_OpenEventLogW_unknown0;

static int hf_eventlog_eventlog_OpenUnknown0_unknown0;

static int hf_eventlog_eventlog_OpenUnknown0_unknown1;

static int hf_eventlog_eventlog_ReadEventLogW_data;

static int hf_eventlog_eventlog_ReadEventLogW_flags;

static int hf_eventlog_eventlog_ReadEventLogW_handle;

static int hf_eventlog_eventlog_ReadEventLogW_number_of_bytes;

static int hf_eventlog_eventlog_ReadEventLogW_offset;

static int hf_eventlog_eventlog_ReadEventLogW_real_size;

static int hf_eventlog_eventlog_ReadEventLogW_sent_size;

static int hf_eventlog_eventlog_Record_closing_record_number;

static int hf_eventlog_eventlog_Record_computer_name;

static int hf_eventlog_eventlog_Record_data_length;

static int hf_eventlog_eventlog_Record_data_offset;

static int hf_eventlog_eventlog_Record_event_category;

static int hf_eventlog_eventlog_Record_event_id;

static int hf_eventlog_eventlog_Record_event_type;

static int hf_eventlog_eventlog_Record_num_of_strings;

static int hf_eventlog_eventlog_Record_raw_data;

static int hf_eventlog_eventlog_Record_record_number;

static int hf_eventlog_eventlog_Record_reserved;

static int hf_eventlog_eventlog_Record_reserved_flags;

static int hf_eventlog_eventlog_Record_sid_length;

static int hf_eventlog_eventlog_Record_sid_offset;

static int hf_eventlog_eventlog_Record_size;

static int hf_eventlog_eventlog_Record_source_name;

static int hf_eventlog_eventlog_Record_stringoffset;

static int hf_eventlog_eventlog_Record_strings;

static int hf_eventlog_eventlog_Record_time_generated;

static int hf_eventlog_eventlog_Record_time_written;

static int hf_eventlog_eventlog_RegisterEventSourceW_handle;

static int hf_eventlog_eventlog_RegisterEventSourceW_logname;

static int hf_eventlog_eventlog_RegisterEventSourceW_servername;

static int hf_eventlog_eventlog_RegisterEventSourceW_unknown0;

static int hf_eventlog_eventlog_RegisterEventSourceW_unknown2;

static int hf_eventlog_eventlog_RegisterEventSourceW_unknown3;

static int hf_eventlog_eventlog_ReportEventW_Type;

static int hf_eventlog_eventlog_ReportEventW_computer_name;

static int hf_eventlog_eventlog_ReportEventW_data_length;

static int hf_eventlog_eventlog_ReportEventW_event_category;

static int hf_eventlog_eventlog_ReportEventW_event_id;

static int hf_eventlog_eventlog_ReportEventW_handle;

static int hf_eventlog_eventlog_ReportEventW_num_of_strings;

static int hf_eventlog_eventlog_ReportEventW_time;

static int hf_eventlog_opnum;

static int hf_eventlog_status;

static int proto_dcerpc_eventlog;

/* Version information */

static e_guid_t uuid_dcerpc_eventlog = {

  0x82273fdc, 0xe32a, 0x18c3,

  { 0x3f, 0x78, 0x82, 0x79, 0x29, 0xdc, 0x23, 0xea }

};

static uint16_t ver_dcerpc_eventlog = 0;

static const true_false_string eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ_tfs = {

   "EVENTLOG_SEQUENTIAL_READ is SET",

   "EVENTLOG_SEQUENTIAL_READ is NOT SET",

};

static const true_false_string eventlogReadFlags_EVENTLOG_SEEK_READ_tfs = {

   "EVENTLOG_SEEK_READ is SET",

   "EVENTLOG_SEEK_READ is NOT SET",

};

static const true_false_string eventlogReadFlags_EVENTLOG_FORWARDS_READ_tfs = {

   "EVENTLOG_FORWARDS_READ is SET",

   "EVENTLOG_FORWARDS_READ is NOT SET",

};

static const true_false_string eventlogReadFlags_EVENTLOG_BACKWARDS_READ_tfs = {

   "EVENTLOG_BACKWARDS_READ is SET",

   "EVENTLOG_BACKWARDS_READ is NOT SET",

};

static const true_false_string eventlogEventTypes_EVENTLOG_ERROR_TYPE_tfs = {

   "EVENTLOG_ERROR_TYPE is SET",

   "EVENTLOG_ERROR_TYPE is NOT SET",

};

static const true_false_string eventlogEventTypes_EVENTLOG_WARNING_TYPE_tfs = {

   "EVENTLOG_WARNING_TYPE is SET",

   "EVENTLOG_WARNING_TYPE is NOT SET",

};

static const true_false_string eventlogEventTypes_EVENTLOG_INFORMATION_TYPE_tfs = {

   "EVENTLOG_INFORMATION_TYPE is SET",

   "EVENTLOG_INFORMATION_TYPE is NOT SET",

};

static const true_false_string eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS_tfs = {

   "EVENTLOG_AUDIT_SUCCESS is SET",

   "EVENTLOG_AUDIT_SUCCESS is NOT SET",

};

static const true_false_string eventlogEventTypes_EVENTLOG_AUDIT_FAILURE_tfs = {

   "EVENTLOG_AUDIT_FAILURE is SET",

   "EVENTLOG_AUDIT_FAILURE is NOT SET",

};

static int eventlog_dissect_element_OpenUnknown0_unknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenUnknown0_unknown1(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_size(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_reserved(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_record_number(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_time_generated(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_time_written(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_event_id(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_event_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_num_of_strings(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_event_category(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_reserved_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_closing_record_number(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_stringoffset(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_sid_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_sid_offset(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_data_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_data_offset(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_source_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_strings(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_Record_raw_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ChangeUnknown0_unknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ChangeUnknown0_unknown1(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ClearEventLogW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ClearEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ClearEventLogW_backupfilename(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ClearEventLogW_backupfilename_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_BackupEventLogW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_BackupEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_BackupEventLogW_backupfilename(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_BackupEventLogW_backupfilename_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_CloseEventLog_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_CloseEventLog_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_DeregisterEventSource_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_DeregisterEventSource_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetNumRecords_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetNumRecords_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetNumRecords_number(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetNumRecords_number_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetOldestRecord_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetOldestRecord_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetOldestRecord_oldest(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetOldestRecord_oldest_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ChangeNotify_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ChangeNotify_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ChangeNotify_unknown2(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ChangeNotify_unknown2_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ChangeNotify_unknown3(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_unknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_unknown0_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_Module(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_RegModuleName(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_MajorVersion(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_MinorVersion(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_unknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_unknown0_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_logname(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_servername(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_unknown2(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_unknown3(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_RegisterEventSourceW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenBackupEventLogW_unknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenBackupEventLogW_unknown0_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenBackupEventLogW_logname(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenBackupEventLogW_unknown2(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenBackupEventLogW_unknown3(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenBackupEventLogW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_OpenBackupEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_offset(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_number_of_bytes(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_data_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_sent_size(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_sent_size_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_real_size(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReadEventLogW_real_size_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_time(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_Type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_event_category(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_event_id(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_num_of_strings(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_data_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_ReportEventW_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_dwInfoLevel(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_lpBuffer(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_lpBuffer_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_cbBufSize(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_cbBytesNeeded(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_GetLogInformation_cbBytesNeeded_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_FlushEventLog_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int eventlog_dissect_element_FlushEventLog_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);

static int

eventlog_dissect_element_ReadEventLogW_data_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)

{

  uint32_t len;

  tvbuff_t *record_tvb;

  if(di->conformant_run){

    /*just a run to handle conformant arrays, nothing to dissect */

    return offset;

  }

  offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,

    hf_eventlog_Record_length, &len);

  /* Create a new tvb so that we know that offset==0 is the beginning

   * of the record. We need to know this since the data is not really

   * NDR encoded at all and there are byte offsets into this buffer

   * encoded therein.

   */

  record_tvb=tvb_new_subset_length_caplen(tvb, offset, MIN((int)len, tvb_captured_length_remaining(tvb, offset)), len);

  eventlog_dissect_struct_Record(record_tvb, 0, pinfo, tree, di, drep, hf_eventlog_Record, 0);

  offset+=len;

  return offset;

}

/* sid_length and sid_offset handled by manual code since this is not NDR

   and we want to dissect the sid from the data blob */

static uint32_t sid_length;

static int

eventlog_dissect_element_Record_sid_length(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)

{

  sid_length=0;

  offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_sid_length,&sid_length);

  return offset;

}

static int

eventlog_dissect_element_Record_sid_offset(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)

{

  uint32_t sid_offset=0;

  offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_sid_offset,&sid_offset);

  if(sid_offset && sid_length){

    tvbuff_t *sid_tvb;

    /* this blob contains an NT SID.

     * tvb starts at the beginning of the record.

     */

    sid_tvb=tvb_new_subset_length_caplen(tvb, sid_offset, MIN((int)sid_length, tvb_captured_length_remaining(tvb, offset)), sid_length);

    dissect_nt_sid(sid_tvb, pinfo, 0, tree, "SID", NULL, -1);

  }

  return offset;

}

static int

eventlog_dissect_element_Record_source_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, uint8_t *drep _U_)

{

  unsigned len;

  len=tvb_unicode_strsize(tvb, offset);

  proto_tree_add_item(tree, hf_eventlog_Record_source_name, tvb, offset, len, ENC_UTF_16|ENC_LITTLE_ENDIAN);

  offset+=len;

  return offset;

}

static int

eventlog_dissect_element_Record_computer_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, uint8_t *drep _U_)

{

  unsigned len;

  len=tvb_unicode_strsize(tvb, offset);

  proto_tree_add_item(tree, hf_eventlog_Record_computer_name, tvb, offset, len, ENC_UTF_16|ENC_LITTLE_ENDIAN);

  offset+=len;

  return offset;

}

static uint16_t num_of_strings;

static int

eventlog_dissect_element_Record_num_of_strings(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)

{

  num_of_strings=0;

  offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_num_of_strings,&num_of_strings);

  return offset;

}

static uint32_t string_offset;

static int

eventlog_dissect_element_Record_stringoffset(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)

{

  string_offset=0;

  offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_stringoffset,&string_offset);

  return offset;

}

static int

eventlog_dissect_element_Record_strings(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, uint8_t *drep _U_)

{

  while(string_offset && num_of_strings){

    unsigned len;

    len=tvb_unicode_strsize(tvb, string_offset);

    proto_tree_add_item(tree, hf_eventlog_Record_string, tvb, string_offset, len, ENC_UTF_16|ENC_LITTLE_ENDIAN);

    string_offset+=len;

    num_of_strings--;

  }

  return offset;

}

/* IDL: bitmap { */

/* IDL:   EVENTLOG_SEQUENTIAL_READ =  0x00000001 , */

/* IDL:   EVENTLOG_SEEK_READ =  0x00000002 , */

/* IDL:   EVENTLOG_FORWARDS_READ =  0x00000004 , */

/* IDL:   EVENTLOG_BACKWARDS_READ =  0x00000008 , */

/* IDL: } */

int

eventlog_dissect_bitmap_eventlogReadFlags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)

{

  proto_item *item;

  static int * const eventlog_eventlogReadFlags_fields[] = {

    &hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ,

    &hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ,

    &hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ,

    &hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ,

    NULL

  };

  uint32_t flags;

  ALIGN_TO_4_BYTES;

  item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,

        ett_eventlog_eventlogReadFlags, eventlog_eventlogReadFlags_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);

  offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);

  if (!flags)

    proto_item_append_text(item, ": (No values set)");

  if (flags & (~0x0000000f)) {

    flags &= (~0x0000000f);

    proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);

  }

  return offset;

}

/* IDL: bitmap { */

/* IDL:   EVENTLOG_SUCCESS =  0x00000000 , */

/* IDL:   EVENTLOG_ERROR_TYPE =  0x00000001 , */

/* IDL:   EVENTLOG_WARNING_TYPE =  0x00000002 , */

/* IDL:   EVENTLOG_INFORMATION_TYPE =  0x00000004 , */

/* IDL:   EVENTLOG_AUDIT_SUCCESS =  0x00000008 , */

/* IDL:   EVENTLOG_AUDIT_FAILURE =  0x00000010 , */

/* IDL: } */

int

eventlog_dissect_bitmap_eventlogEventTypes(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)

{

  proto_item *item;

  static int * const eventlog_eventlogEventTypes_fields[] = {

    &hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE,

    &hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE,

    &hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE,

    &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS,

    &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE,

    NULL

  };

  uint32_t flags;

  ALIGN_TO_4_BYTES;

  item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,

        ett_eventlog_eventlogEventTypes, eventlog_eventlogEventTypes_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);

  offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);

  if (!flags)

    proto_item_append_text(item, ": (No values set)");

  if (flags & (~0x0000001f)) {

    flags &= (~0x0000001f);

    proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);

  }

  return offset;

}

/* IDL: struct { */

/* IDL:   uint16 unknown0; */

/* IDL:   uint16 unknown1; */

/* IDL: } */

static int

eventlog_dissect_element_OpenUnknown0_unknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_OpenUnknown0_unknown0, 0);

  return offset;

}

static int

eventlog_dissect_element_OpenUnknown0_unknown1(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_OpenUnknown0_unknown1, 0);

  return offset;

}

int

eventlog_dissect_struct_OpenUnknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)

{

  proto_item *item = NULL;

  proto_tree *tree = NULL;

  int old_offset;

  ALIGN_TO_2_BYTES;

  old_offset = offset;

  if (parent_tree) {

    item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);

    tree = proto_item_add_subtree(item, ett_eventlog_eventlog_OpenUnknown0);

  }

  offset = eventlog_dissect_element_OpenUnknown0_unknown0(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_OpenUnknown0_unknown1(tvb, offset, pinfo, tree, di, drep);

  proto_item_set_len(item, offset-old_offset);

  if (di->call_data->flags & DCERPC_IS_NDR64) {

    ALIGN_TO_2_BYTES;

  }

  return offset;

}

/* IDL: struct { */

/* IDL:   uint32 size; */

/* IDL:   uint32 reserved; */

/* IDL:   uint32 record_number; */

/* IDL:   uint32 time_generated; */

/* IDL:   uint32 time_written; */

/* IDL:   uint32 event_id; */

/* IDL:   uint16 event_type; */

/* IDL:   uint16 num_of_strings; */

/* IDL:   uint16 event_category; */

/* IDL:   uint16 reserved_flags; */

/* IDL:   uint32 closing_record_number; */

/* IDL:   uint32 stringoffset; */

/* IDL:   uint32 sid_length; */

/* IDL:   uint32 sid_offset; */

/* IDL:   uint32 data_length; */

/* IDL:   uint32 data_offset; */

/* IDL:   [flag(LIBNDR_FLAG_STR_NULLTERM)] string source_name; */

/* IDL:   [flag(LIBNDR_FLAG_STR_NULLTERM)] string computer_name; */

/* IDL:   [flag(LIBNDR_FLAG_STR_NULLTERM)] string strings[num_of_strings]; */

/* IDL:   [flag(LIBNDR_FLAG_STR_ASCII|LIBNDR_FLAG_STR_NULLTERM)] string raw_data; */

/* IDL: } */

static int

eventlog_dissect_element_Record_size(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_size, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_reserved(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_reserved, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_record_number(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_record_number, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_time_generated(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_time_generated, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_time_written(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_time_written, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_event_id(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_event_id, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_event_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_event_type, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_event_category(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_event_category, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_reserved_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_reserved_flags, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_closing_record_number(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_closing_record_number, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_data_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_data_length, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_data_offset(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_data_offset, 0);

  return offset;

}

static int

eventlog_dissect_element_Record_raw_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_null_term_string(tvb, offset, pinfo, tree, drep, hf_eventlog_eventlog_Record_raw_data , 0);

  return offset;

}

int

eventlog_dissect_struct_Record(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)

{

  proto_item *item = NULL;

  proto_tree *tree = NULL;

  int old_offset;

  ALIGN_TO_4_BYTES;

  old_offset = offset;

  if (parent_tree) {

    item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);

    tree = proto_item_add_subtree(item, ett_eventlog_eventlog_Record);

  }

  offset = eventlog_dissect_element_Record_size(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_reserved(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_record_number(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_time_generated(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_time_written(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_event_id(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_event_type(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_num_of_strings(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_event_category(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_reserved_flags(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_closing_record_number(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_stringoffset(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_sid_length(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_sid_offset(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_data_length(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_data_offset(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_source_name(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_computer_name(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_strings(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_Record_raw_data(tvb, offset, pinfo, tree, di, drep);

  proto_item_set_len(item, offset-old_offset);

  if (di->call_data->flags & DCERPC_IS_NDR64) {

    ALIGN_TO_4_BYTES;

  }

  return offset;

}

/* IDL: struct { */

/* IDL:   uint32 unknown0; */

/* IDL:   uint32 unknown1; */

/* IDL: } */

static int

eventlog_dissect_element_ChangeUnknown0_unknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_ChangeUnknown0_unknown0, 0);

  return offset;

}

static int

eventlog_dissect_element_ChangeUnknown0_unknown1(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_ChangeUnknown0_unknown1, 0);

  return offset;

}

int

eventlog_dissect_struct_ChangeUnknown0(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)

{

  proto_item *item = NULL;

  proto_tree *tree = NULL;

  int old_offset;

  ALIGN_TO_4_BYTES;

  old_offset = offset;

  if (parent_tree) {

    item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);

    tree = proto_item_add_subtree(item, ett_eventlog_eventlog_ChangeUnknown0);

  }

  offset = eventlog_dissect_element_ChangeUnknown0_unknown0(tvb, offset, pinfo, tree, di, drep);

  offset = eventlog_dissect_element_ChangeUnknown0_unknown1(tvb, offset, pinfo, tree, di, drep);

  proto_item_set_len(item, offset-old_offset);

  if (di->call_data->flags & DCERPC_IS_NDR64) {

    ALIGN_TO_4_BYTES;

  }

  return offset;

}

static int

eventlog_dissect_element_ClearEventLogW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_ClearEventLogW_handle_, NDR_POINTER_REF, "Pointer to Handle (policy_handle)",hf_eventlog_eventlog_ClearEventLogW_handle);

  return offset;

}

static int

eventlog_dissect_element_ClearEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_ClearEventLogW_handle, 0);

  return offset;

}

static int

eventlog_dissect_element_ClearEventLogW_backupfilename(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_ClearEventLogW_backupfilename_, NDR_POINTER_UNIQUE, "Pointer to Backupfilename (lsa_String)",hf_eventlog_eventlog_ClearEventLogW_backupfilename);

  return offset;

}

static int

eventlog_dissect_element_ClearEventLogW_backupfilename_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset=dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_ClearEventLogW_backupfilename, 0);

  return offset;

}

/* IDL: NTSTATUS eventlog_ClearEventLogW( */

/* IDL: [in] [ref] policy_handle *handle, */

/* IDL: [in] [unique(1)] lsa_String *backupfilename */

/* IDL: ); */

static int

eventlog_dissect_ClearEventLogW_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  uint32_t status;

  di->dcerpc_procedure_name="ClearEventLogW";

  offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, hf_eventlog_status, &status);

  if (status != 0)

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &NT_errors_ext, "Unknown NT status 0x%08x"));

  return offset;

}

static int

eventlog_dissect_ClearEventLogW_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  di->dcerpc_procedure_name="ClearEventLogW";

  offset = eventlog_dissect_element_ClearEventLogW_handle(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  offset = eventlog_dissect_element_ClearEventLogW_backupfilename(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  return offset;

}

static int

eventlog_dissect_element_BackupEventLogW_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_BackupEventLogW_handle_, NDR_POINTER_REF, "Pointer to Handle (policy_handle)",hf_eventlog_eventlog_BackupEventLogW_handle);

  return offset;

}

static int

eventlog_dissect_element_BackupEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_BackupEventLogW_handle, 0);

  return offset;

}

static int

eventlog_dissect_element_BackupEventLogW_backupfilename(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_BackupEventLogW_backupfilename_, NDR_POINTER_UNIQUE, "Pointer to Backupfilename (lsa_String)",hf_eventlog_eventlog_BackupEventLogW_backupfilename);

  return offset;

}

static int

eventlog_dissect_element_BackupEventLogW_backupfilename_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset=dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_BackupEventLogW_backupfilename, 0);

  return offset;

}

/* IDL: NTSTATUS eventlog_BackupEventLogW( */

/* IDL: [in] [ref] policy_handle *handle, */

/* IDL: [in] [unique(1)] lsa_String *backupfilename */

/* IDL: ); */

static int

eventlog_dissect_BackupEventLogW_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  uint32_t status;

  di->dcerpc_procedure_name="BackupEventLogW";

  offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, hf_eventlog_status, &status);

  if (status != 0)

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &NT_errors_ext, "Unknown NT status 0x%08x"));

  return offset;

}

static int

eventlog_dissect_BackupEventLogW_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  di->dcerpc_procedure_name="BackupEventLogW";

  offset = eventlog_dissect_element_BackupEventLogW_handle(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  offset = eventlog_dissect_element_BackupEventLogW_backupfilename(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  return offset;

}

static int

eventlog_dissect_element_CloseEventLog_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_CloseEventLog_handle_, NDR_POINTER_REF, "Pointer to Handle (policy_handle)",hf_eventlog_eventlog_CloseEventLog_handle);

  return offset;

}

static int

eventlog_dissect_element_CloseEventLog_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_CloseEventLog_handle, PIDL_POLHND_CLOSE);

  return offset;

}

/* IDL: NTSTATUS eventlog_CloseEventLog( */

/* IDL: [in] [out] [ref] policy_handle *handle */

/* IDL: ); */

static int

eventlog_dissect_CloseEventLog_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  uint32_t status;

  di->dcerpc_procedure_name="CloseEventLog";

  offset = eventlog_dissect_element_CloseEventLog_handle(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, hf_eventlog_status, &status);

  if (status != 0)

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &NT_errors_ext, "Unknown NT status 0x%08x"));

  return offset;

}

static int

eventlog_dissect_CloseEventLog_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  di->dcerpc_procedure_name="CloseEventLog";

  offset = eventlog_dissect_element_CloseEventLog_handle(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  return offset;

}

static int

eventlog_dissect_element_DeregisterEventSource_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_DeregisterEventSource_handle_, NDR_POINTER_REF, "Pointer to Handle (policy_handle)",hf_eventlog_eventlog_DeregisterEventSource_handle);

  return offset;

}

static int

eventlog_dissect_element_DeregisterEventSource_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_DeregisterEventSource_handle, 0);

  return offset;

}

/* IDL: NTSTATUS eventlog_DeregisterEventSource( */

/* IDL: [in] [out] [ref] policy_handle *handle */

/* IDL: ); */

static int

eventlog_dissect_DeregisterEventSource_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  uint32_t status;

  di->dcerpc_procedure_name="DeregisterEventSource";

  offset = eventlog_dissect_element_DeregisterEventSource_handle(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, hf_eventlog_status, &status);

  if (status != 0)

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &NT_errors_ext, "Unknown NT status 0x%08x"));

  return offset;

}

static int

eventlog_dissect_DeregisterEventSource_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  di->dcerpc_procedure_name="DeregisterEventSource";

  offset = eventlog_dissect_element_DeregisterEventSource_handle(tvb, offset, pinfo, tree, di, drep);

  offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

  return offset;

}

static int

eventlog_dissect_element_GetNumRecords_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_GetNumRecords_handle_, NDR_POINTER_REF, "Pointer to Handle (policy_handle)",hf_eventlog_eventlog_GetNumRecords_handle);

  return offset;

}

static int

eventlog_dissect_element_GetNumRecords_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_GetNumRecords_handle, 0);

  return offset;

}

static int

eventlog_dissect_element_GetNumRecords_number(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, eventlog_dissect_element_GetNumRecords_number_, NDR_POINTER_REF, "Pointer to Number (uint32)",hf_eventlog_eventlog_GetNumRecords_number);

  return offset;

}

static int

eventlog_dissect_element_GetNumRecords_number_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)

{

  offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_GetNumRecords_number, 0);

  return offset;

}

/* IDL: NTSTATUS eventlog_GetNumRecords( */

/* IDL: [in] [ref] policy_handle *handle, */

/* IDL: [out] [ref] uint32 *number */

/* IDL: ); */